Struct DatConstraints 

pub struct DatConstraints {
    pub max_actions: Option<u64>,
    pub allowed_servers: Option<Vec<String>>,
    pub require_receipt: Option<bool>,
    pub rate_limit: Option<RateLimit>,
    pub ip_allowlist: Option<Vec<String>>,
    pub ip_denylist: Option<Vec<String>>,
    pub min_trust_level: Option<u8>,
    pub max_delegation_depth: Option<u32>,
    pub allowed_countries: Option<Vec<String>>,
    pub time_windows: Option<Vec<TimeWindow>>,
    pub required_config_hash: Option<String>,
}

Full constraint set that can be embedded in a DAT.

All fields are optional — absent means “no restriction on this axis”.

Fields

max_actions: Option<u64>

Maximum total actions allowed under this DAT (lifetime cap).

allowed_servers: Option<Vec<String>>

Allowed MCP server hostnames/patterns.

require_receipt: Option<bool>

Whether every action MUST produce an Action Receipt.

rate_limit: Option<RateLimit>

Sliding-window rate limit.

ip_allowlist: Option<Vec<String>>

CIDR ranges that are allowed to present this DAT. If set, the request IP MUST match at least one entry.

ip_denylist: Option<Vec<String>>

CIDR ranges that are explicitly denied. Evaluated AFTER allowlist — a deny always wins.

min_trust_level: Option<u8>

Minimum trust level the presenting agent must have (0–100 scale).

max_delegation_depth: Option<u32>

Maximum delegation chain depth allowed (0 = no re-delegation).

allowed_countries: Option<Vec<String>>

ISO 3166-1 alpha-2 country codes that are allowed. If set, the request country MUST be in this list.

time_windows: Option<Vec<TimeWindow>>

UTC time windows during which the DAT may be used.

required_config_hash: Option<String>

Required SHA-256 hex hash of the agent’s config. Stored in DatClaims.config_attestation; evaluator checks it matches.

Implementations

impl DatConstraints

pub fn evaluate(&self, ctx: &EvaluationContext) -> Result<()>

Run all applicable evaluators against the provided context.

Returns the first violation found, or Ok(()) if everything passes.

pub fn eval_rate_limit(&self, ctx: &EvaluationContext) -> Result<()>

Checks that ctx.actions_in_window has not exceeded the rate limit.

NOTE: This evaluator checks a snapshot supplied by the caller — it does NOT maintain state itself (state lives in the runtime/middleware layer).

pub fn eval_ip_allowlist(&self, ctx: &EvaluationContext) -> Result<()>

If ip_allowlist is set, the request IP must match at least one CIDR.

pub fn eval_ip_denylist(&self, ctx: &EvaluationContext) -> Result<()>

If the request IP matches any entry in ip_denylist, deny immediately.

pub fn eval_trust_level(&self, ctx: &EvaluationContext) -> Result<()>

The agent’s trust level must be >= min_trust_level.

pub fn eval_delegation_depth(&self, ctx: &EvaluationContext) -> Result<()>

The delegation chain depth must not exceed max_delegation_depth.

pub fn eval_geofence(&self, ctx: &EvaluationContext) -> Result<()>

If allowed_countries is set, the request country code must be listed.

pub fn eval_time_windows(&self, ctx: &EvaluationContext) -> Result<()>

If time_windows is set, the current time must fall within at least one window. Hours are evaluated in UTC.

pub fn eval_config_attestation( &self, ctx: &EvaluationContext, token_config_hash: Option<&str>, ) -> Result<()>

Verify that the agent’s current config hash matches the one required by the constraint AND the one recorded in the DAT claims.

token_config_hash is the value from DatClaims.config_attestation.

Trait Implementations

impl Clone for DatConstraints

fn clone(&self) -> DatConstraints

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DatConstraints

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DatConstraints

fn default() -> DatConstraints

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DatConstraints

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for DatConstraints

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.